NIST 800-171 R3 03.15.02 System Security Plan at a Glance
- Family: 03.15 Planning (PL)
- Requirement ID: 03.15.02 System Security Plan
- Assessment Objectives (AOs): Twelve (12) total, including the one (1) Organization-Defined Parameters (ODPs) below and eleven (11) determination statements
- Organization-Defined Parameters (ODPs): One (1), specified by the Department of Defense (DoD) for the Defense Industrial Base (DIB)
- Source NIST 800-53 R5 Control: PL-02
- NIST 800-171 R3 Kill Chain Phase: Phase 5a, Document The CUI and/or FCI Environment
System Security Plan is the requirement behind the single most important document in your compliance program, and R3 expects considerably more from it than R2 did. It moved families in R3, growing from the Security Assessment area into the Planning (03.15) family, and it picked up new content requirements along the way. System Security Plan (03.15.02) has three (3) parts: develop a system security plan (SSP) covering eight specific elements, review and update it on a defined frequency, and protect it from unauthorized disclosure. Per the NIST discussion, system security plans provide key characteristics of the system that is processing, storing, and transmitting Controlled Unclassified Information (CUI) and how the system and information are protected, and they can be a collection of documents, including documents that already exist.
A common difficulty with this requirement is carrying a R2 era SSP forward unchanged. R3 adds four new content elements and a new obligation to protect the plan itself, so a document that satisfied R2 will have gaps. The most commonly missed additions are identifying the information types the system handles and describing the specific threats of concern to your organization, neither of which R2 asked for.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.15.02 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.15.02 System Security Plan. Only the formatting has been adjusted for readability. This requirement has three (3) lettered parts, the first with numbered sub-parts:
- a. Develop a system security plan that:
- Defines the constituent system components;
- Identifies the information types processed, stored, and transmitted by the system;
- Describes specific threats to the system that are of concern to the organization;
- Describes the operational environment for the system and any dependencies on or connections to other systems or system components;
- Provides an overview of the security requirements for the system;
- Describes the safeguards in place or planned for meeting the security requirements;
- Identifies individuals that fulfill system roles and responsibilities; and
- Includes other relevant information necessary for the protection of CUI.
- b. Review and update the system security plan [Assignment: organization-defined frequency].
- c. Protect the system security plan from unauthorized disclosure.
The source control is PL-02 from NIST 800-53. The bracketed assignment in part b is the Organization-Defined Parameter (ODP): the review and update frequency. Per the NIST discussion, effective system security plans reference policies, procedures, and documents that provide additional detailed information, which reduces the documentation requirements associated with security programs. You can read the requirement directly at NIST 800-171 R3, 03.15.02 (p. 68).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.15.02?
One (1) value sits inside this requirement. Depending on your contract, your organization may be permitted to define it. Organizations in the DIB subject to CMMC are not, because the DoD has defined it as policy.
The value below comes from Attachment A of the DoD Chief Information Officer (CIO) memorandum dated 10 April 2025 (signed David W. McKeown). The memo identifies each parameter by requirement sub-part, while NIST 800-171A R3 identifies the same parameter by ODP number. Both identifiers appear below so you can match your System Security Plan (SSP) language to either document.
- ODP[01] (DoD memo identifier 03.15.02.b). the frequency at which the system security plan is reviewed and updated is defined. DoD Position: at least every 12 months, or when there are significant incidents or significant changes to risks.
The memo states that its values "will be updated as necessary," so confirm against the current version before writing them into policy.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.15.02?
NIST 800-171A R3 breaks 03.15.02 into twelve (12) assessment objectives: one (1) Organization-Defined Parameter (ODP) and eleven (11) determination statements. These AOs are:
- A.03.15.02.ODP[01]: the frequency at which the system security plan is reviewed and updated is defined.
- A.03.15.02.a.01: a system security plan that defines the constituent system components is developed.
- A.03.15.02.a.02: a system security plan that identifies the information types processed, stored, and transmitted by the system is developed.
- A.03.15.02.a.03: a system security plan that describes specific threats to the system that are of concern to the organization is developed.
- A.03.15.02.a.04: a system security plan that describes the operational environment for the system and any dependencies on or connections to other systems or system components is developed.
- A.03.15.02.a.05: a system security plan that provides an overview of the security requirements for the system is developed.
- A.03.15.02.a.06: a system security plan that describes the safeguards in place or planned for meeting the security requirements is developed.
- A.03.15.02.a.07: a system security plan that identifies individuals that fulfill system roles and responsibilities is developed.
- A.03.15.02.a.08: a system security plan that includes other relevant information necessary for the protection of CUI is developed.
- A.03.15.02.b[01]: the system security plan is reviewed <A.03.15.02.ODP[01]: frequency>.
- A.03.15.02.b[02]: the system security plan is updated <A.03.15.02.ODP[01]: frequency>.
- A.03.15.02.c: the system security plan is protected from unauthorized disclosure.
Each of the eight content elements is its own objective, so an SSP missing any one of them leaves that objective open. If you are a DoD contractor, the ODP is specified. Per the DoD-specified ODP value in ComplianceForge's NIST 800-171 R3 Transition Guide, the review and update frequency (ODP[01]) is at least every twelve (12) months, or when there are significant incidents or significant changes to risks. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.15.02 (p. 89).
Assessment Methods and Objects for NIST 800-171 R3 03.15.02
Examine: security planning policy and procedures; procedures for system security plan development and implementation; procedures for system security plan reviews and updates; enterprise architecture; system security plan; records of system security plan reviews and updates; risk assessments; risk assessment results; security architecture and design documentation.
Interview: personnel with system security planning and plan implementation responsibilities; system developers; personnel with information security responsibilities.
Test: processes for system security plan development, review, update, and approval.
How Does NIST 800-171 R3 03.15.02 Map From NIST 800-171 R2?
03.15.02 maps from NIST 800-171 R2 requirement 3.12.4 (develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems). R3 withdrew 03.12.04 and incorporated it here, which moves the SSP out of the Security Assessment family and into Planning:
- A.03.15.02.a.01 maps directly to R2 3.12.4[a] (a system security plan is developed).
- A.03.15.02.a.04 maps directly to R2 3.12.4[b], 3.12.4[c], and 3.12.4[f] (the system boundary, environment of operation, and relationships with or connections to other systems are described).
- A.03.15.02.a.05 maps directly to R2 3.12.4[d].
- A.03.15.02.a.06 maps directly to R2 3.12.4[e] (the method of security requirement implementation is described and documented).
- A.03.15.02.ODP[01] maps directly to R2 3.12.4[g] (the frequency to update the system security plan is defined).
- A.03.15.02.b[01] and A.03.15.02.b[02] map directly to R2 3.12.4[h] (the plan is updated with the defined frequency).
- A.03.15.02.a.02, A.03.15.02.a.03, A.03.15.02.a.07, A.03.15.02.a.08, and A.03.15.02.c are all net new for R3.
Mapped against the twelve (12) AOs, seven (7) are direct (minimal effort) and five (5) are net new (significant effort). The core of the plan carries forward. The new work is four additional content elements (information types, specific threats of concern, individuals fulfilling system roles and responsibilities, and other relevant information necessary for protecting CUI) plus the obligation to protect the plan from unauthorized disclosure. Treat a R2 SSP as a starting point that needs five additions, not as a finished document.
How Does NIST 800-171 R3 03.15.02 Map to NIST 800-53 R5 and the SCF?
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.15.02 through the following SCF controls:
- AST-17.1 Control Applicability Boundary Graphical Representation
- CPL-03 Compliance Scope
- DCH-06.1 Defining Access Authorizations for Sensitive / Regulated Data
- DCH-08.2 Disclosure of Sensitive / Regulated Data
- IAO-09 Applied Security, Compliance and Resilience Controls Documentation
- RSK-10 Risk Catalog
- THR-06 Threat Catalog
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.15.02
The following are issues teams may encounter rather than certainties. They are about the new content elements and protecting the plan, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- Five new obligations. A.03.15.02.a.02, a.03, a.07, a.08, and c are all net new, so an SSP inherited from R2 will have gaps in information types, threats, roles, and plan protection.
- The plan itself needs protecting. A.03.15.02.c is net new and requires the SSP to be protected from unauthorized disclosure. It is a roadmap to your environment, so an SSP on an open file share leaves this objective open.
- Threats must be specific. A.03.15.02.a.03 requires describing specific threats of concern to the organization, so generic threat language will not demonstrate the objective.
- Every element is assessed. Eight separate content objectives mean an assessor works down the list, so map your SSP sections to a.01 through a.08 explicitly.
- Reuse what exists. Per the NIST discussion, the SSP can be a collection of documents and can reference existing policies and procedures, so you do not need to duplicate content you already maintain.
What Is Reasonable Evidence For NIST 800-171 R3 03.15.02?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.15.02 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.15.02 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-AST-02 Asset Scoping Guidance. An asset scoping guidance. this is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on defining in-scope technology assets, applications, services and/or data (taasd) (including third-parties).
- E-CPL-02 Defined Compliance Scope (DCS). A formal scoping document that identifies applicable statutory, regulatory and/or contractual obligations for the organization. defines the affected lines of business (lob), internal / external stakeholders and facilities for the specific scope of compliance obligations.
- E-DCH-02 Data Handling Practices. An organization-specific data handling practices (e.g., guidance specific the data classification scheme).
- E-DCH-08 Authorization Documentation. That identifies authorized users and processes acting on behalf of authorized users.
- E-RSK-09 Risk Catalog. A risk catalog.
- E-TDA-14 System Security Plan (SSP). At least one (1) system security plan (ssp) that covers the sensitive/regulated data environment. there may be multiple ssps, based on applicable contracts.
- E-TDA-18 System Security Plan (SSP) Reviews. Reviews and/or updates to system security plan (ssp) documentation.
- E-THR-06 Threat Catalog. A threat catalog.
Alongside these, keep the System Security Plan (SSP) narrative for 03.15.02 recording the ODP values you adopted.
Timeline Considerations for NIST 800-171 R3 03.15.02
With seven (7) AOs mapping directly and five net new, 03.15.02 is a significant lift centered on expanding an existing plan. A realistic sequence:
- Define the review and update frequency (A.03.15.02.ODP[01], at least every twelve months for DoD).
- Confirm the existing content carries over: constituent components, operational environment and connections, security requirements overview, and safeguards (A.03.15.02.a.01, a.04, a.05, a.06).
- Add the information types processed, stored, and transmitted (A.03.15.02.a.02) and the specific threats of concern (A.03.15.02.a.03).
- Add the individuals fulfilling system roles and responsibilities (A.03.15.02.a.07) and any other relevant information necessary to protect CUI (A.03.15.02.a.08).
- Protect the plan from unauthorized disclosure through access controls (A.03.15.02.c).
- Run the review and update cycle (A.03.15.02.b[01] and b[02]).
- Collect evidence for all twelve (12) AOs, including the plan, its revision history, and the access controls protecting it.
Frequently Asked Questions About NIST 800-171 R3 03.15.02
What value does the DoD require for the organization-defined parameter in NIST 800-171 R3 03.15.02? R3 leaves the value to the organization. For the DIB, the DoD set it in the 10 April 2025 memorandum under ODP identifier 03.15.02.b: at least every 12 months, or when there are significant incidents or significant changes to risks.
How many assessment objectives does NIST 800-171 R3 03.15.02 have? NIST 800-171A R3 breaks 03.15.02 into twelve (12) assessment objectives: one (1) Organization-Defined Parameters (ODPs) and eleven (11) determination statements. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.15.02 come from? PL-02.
Where does NIST 800-171 R3 03.15.02 sit in the NIST 800-171 R3 Kill Chain? Phase 5a, Document The CUI and/or FCI Environment. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.15.02
03.15.02 System Security Plan develops an SSP covering eight specific content elements, reviews and updates it on a defined frequency, and protects it from unauthorized disclosure. It maps from R2 3.12.4, now relocated into the Planning family, with seven of twelve (12) objectives transitioning directly. The five net-new pieces are information types, specific threats, individuals in system roles, other relevant information, and protecting the plan. The recurring problem is reusing a R2 SSP as-is. Map your sections to each objective, fill the four new content gaps, lock the document down, and review it at least every twelve months.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3 and references the DoD ODP memorandum of 10 April 2025. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
